SBOM and provenance
Records what went into a build and signs it, so consumers can verify where an artifact came from and what it contains.
Sub-techniques
2
| ID | Name | Description |
|---|---|---|
V1017.001 | SBOM generation | Emit an SPDX or CycloneDX bill of materials per release. |
V1017.002 | Signing and attestation | Sign artifacts and attach build provenance (SLSA). |
Craft it
- Generate an SBOM in the release workflow and publish it with the artifact.
- Sign with keyless signing from CI identity.
- Verify signatures in deployment.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- Release workflows calling syft, cosign or actions/attest-build-provenance.
- *.sbom.json or *.intoto.jsonl assets on releases.
Open-source packages
3
- Syft anchore/syft
- Sigstore cosign sigstore/cosign
- SLSA GitHub generator slsa-framework/slsa-github-generator